Which Cisco AMP feature allows an engineer to look back to trace past activities, such as file and process activity on an endpoint?

Which Cisco AMP feature allows an engineer to look back to trace past activities, such as file and process activity on an endpoint?
A. endpoint isolation
B. advanced search
C. advanced investigation
D. retrospective security

350-701: Implementing and Operating Cisco Security Core Technologies Free dumps for 350-701 in PDF format. High quality 350-701 PDF and software. VALID exam to help you pass.